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Abstract 

Valiant- Vazirani sliowed in 1985 IVV85I that solving NP with the promise that "yes" instances have only 
one witness is powerful enough to solve the entire NP class (under randomized reductions). 

We are interested in extending this result to the quantum setting. We prove extensions to the classes Merlin- 
Arthur (MA) and Quantum-Classical-Merlin- Arthur (QCMA) IAN02I . Our results have implications on the 
complexity of approximating the ground state energy of a quantum local Hamiltonian with a unique ground 
state and an inverse polynomial spectral gap. We show that the estimation, to within polynomial accuracy, of 
the ground state energy of poly-gapped 1-D local Hamiltonians is QCMA-hard, under randomized reductions. 
This is in strong contrast to the case of constant gapped 1-D Hamiltonians, which is in NP IHas07l . Moreover, 
it shows that unless QCMA can be reduced to NP by randomized reductions, there is no classical description 
of the ground state of every poly-gapped local Hamiltonian which allows the calculation of expectation values 
efficiently. 

Finally, we discuss a few obstacles towards establishing an analogous result to the class Quantum-Merlin- 
Arthur (QMA). In particular, we show that random projections fails to provide a polynomial gap between two 
witnesses. 

1 Introduction and Results 
1.1 Extending Valiant- Vazirani 

One of the properties of the class NP is that the number of witnesses might vary from zero to exponentially 
many. How hard is it to distinguish between "no" instances and "yes" instances that have a unique witness? 
One might think that such a problem is easier than solving NP. In a celebrated result. Valiant and Vazirani 
IIVV85I showed that access to an oracle which can decide between "no" and "unique yes" instances is enough 
to solve the NP-complete problem SAT, with high probability, using randomized reductions 0. 

The classes MA, QCMA IIAN02I and QMA rtKVS+02l are probabilistic and quantum analogues of NP. 
Informally, we say a problem is in MA if for every "yes" instance there is a witness which makes the verifier to 
accept with high probability (e.g. in the range (2/3, 1)), while for "no" instances he only accepts with a small 

* School of Computer Science and Engineering, The Hebrew University, Jerusalem, Israel, doria@cs.huji.ac.il. 
^School of Computer Science and Engineering, The Hebrew University, Jerusalem, Israel, benor@cs.huji.ac.il. 
tinstitute for Mathematical Sciences, Imperial College London. feiTiando.brandao@imperial.ac.uk 
^School of Computer Science and Engineering, The Hebrew University, Jerusalem, Israel, sattath@cs.huji.ac.il. 

' A promise problem A is reducible to B by a randomized reduction, if there exists a probabilistic polynomial Turing Machine (TM) M 
and a polynomial p s.t.: 

• completeness: x 6 Ayes => Prr{M{x,r) G Byes) > l/pd^^l) 

• perfect soundness: x G A„o Vr M{x, r) G B„o 

where r are the random bits of the TM M. We denote this by A B. 
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probability (e.g. in (0, 1/3)), no matter which witness is given to him. The class QCMA is defined in a similar 
manner, but now the verifier can use a quantum computer to decide whether to accept or not. In QMA, in turn, 
not only does the verifier use a quantum computer to check the proof, but also the proof itself is a quantum state 
composed of a polynomial (in the input size) number of qubits. 

We can ask a similar question to that of Valiant and Vazirani about each of these classes: given access to an 
oracle that can only decide between "no" instances and "yes" instances which have a unique solution for MA, 
QCMA, or QMA, can we solve complete problems for those classes, with high probability? The quantum related 
questions are also motivated by physical questions about ground states of local Hamiltonians. We provide some 
interesting implications in this direction, which we will soon describe. 

In this paper we partially solve these questions: we present a generalization of the Valiant- Vazirani result to 
MA and QCMA. We also discuss some obstructions towards establishing a similar result to QMA, which is left 
as an open problem. 

We define DMA and UQCMA as the restrictions of MA and QCMA, respectively, to instances with a unique 
witness. Roughly speaking, in a "yes" instance of a problem in DMA or UQCMA, one proof convinces the 
verifier with probability larger than e.g. 2/3, while any other witness makes him accept with probability of at 
most 1 /3. In a "no" instance, the verifier accepts any witness with probability at most 1/3. Our two main results 
are: 

Theorem 1 MA = UMA^ 

Theorem 2 UQCMA = QCMA. 

The proofs of both theorems rely heavily on the Valiant- Vazirani construction IIVV85IIAB09I . which can be 
divided into three components: 

1. We could guess the size of the accepting witness set, and use a random "filter" with a certain degree 
of screening, which is determined by the set size. If we guess correctly, then with constant probability, 
exactly one witness will pass the filter. 

2. We notice that it is not crucial to guess the exact size of the set - and a multiplicative approximation is 
enough. In this way, the possible number of guesses is reduced from exponentially many in the previous 
component, to linear (in the length of the witness). 

3. we replace the random "filter" with a pseudo random "filter" - a universal hash function - without loosing 
any of the properties. These pseudo-random objects have the advantage of an efficient description, unlike 
truly random sets. 

The probabilistic setting of MA and QCMA raises a new difficulty: on "yes" instances there might be an 
exponentially larger number of witnesses in the gap-interval (e.g. (1/3,2/3)) than in the "yes" interval (2/3,1). 
Thus, a random choice of one of the witnesses - in the spirit of the Valiant- Vazirani approach - would, with 
overwhelming large probability, fail to choose a witness from the "yes" interval. The main idea in overcoming 
this obstacle is to divide the "gap" interval into polynomially many smaller intervals, and argue that in at least 
one of them, the number of witnesses inside it is not much larger than the number of witnesses in the intervals 
above it. 

We can also define the class UQMA - a unique variant of QMA - with the hope of proving the analogous 
result. It is defined as follows: the conditions for a "no" instance are the same as in QMA, but for a "yes" 
instance, we demand that there exists a lip) which is accepted above the "yes"-threshold, and all states 
orthogonal to it are accepted with probability below the "no"-threshold. Before we proceed to show that an 
analogous result for QMA is probably impossible to achieve using similar techniques to the ones we employ, 
we use this definition together with Theorem|2]to derive interesting implications. 



^We say that the class Ci is included in C2 under randomized reduction, and denote it by Ci C C'2 if for every Li £ Ci there exists 
L2 e C2 s.t. Ci diR C2. 
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1.2 Implications to Ground State and Hamiltonian Complexity 

We say a Hamiltonian, acting on n d-dimensional particles, is fc-local if it can be written as a sum of poly(n) 
terms which act non-trivially at most on k sites. 

Definition 3 A:-L0CAL hamiltonian; We are given a k-local Hamiltonian on n qubits H = X]j=i with 
r = poly{n). Each Hj has a bounded operator norm \ \Hj \ \ < poly{n). We are also given two constants a and 
b with b — a > l/poly{n). In "yes" instances, the smallest eigenvalue of H is at most a. In "no" instances, it 
is larger than b. We should decide which one is the case. 

In a seminal work, Kitaev showed that the 5-LOCAL HAMILTONIAN problem is complete for QMA IIKit99l . 
Improvements in parameters (dimensionality and locality) were given in lKR03l fKKR06, OTOS), leading to the 
QMA-completeness of 1-D 2-LOCAL HAMILTONIAN IIAGIK07I . which is the variant of the original problem 
to one-dimensional nearest-neighbors Hamiltonians (with d = 12). The importance of these results stems not 
only from the fact that LOCAL HAMILTONIAN is probably the most representative QMA-complete problem, but 
also from the key role of local Hamiltonians and their ground-state energy in physics. 

An important parameter when dealing with the complexity of ground states and local Hamiltonians is the 
spectral gap of local Hamiltonians, given by the difference of the ground and the first excited energy levels, 
A :— Xi{H) — Xo{H). When the spectral gap is constant, the Hamiltonian is said to be gapped. When it is 
inverse polynomial, we say the Hamiltonian is poly-gapped. 

What are the implications of a gap for the LOCAL HAMILTONIAN problem? A groundbreaking result by 
Hastings shows that ground states of 1-D gapped Hamiltonians have an efficient classical description, as a 
Matrix-Product-State (MPS) of polynomial bond dimension IIHasOTrl Since expectation values of local ob- 



servables of an MPS can be calculated in polynomial time in the number of sites and in its bond dimension (see 
e.g. IIPGVWC06II ). Hastings' result implies that 1 -D CONSTANT-GAP LOCAL HAMILTONIAN (the restriction of 
the original problem to 1-D gapped Hamiltonians) belongs to NP. 

It has been asked whether such efficient descriptions might exist for the ground state of 1-D poly gapped 
Hamiltonians. We show that using TheoremlH and some more work, one can deduce that the answer to this 
question is negative (under some reasonable complexity assumption). The reasoning is as follows. 

We define the UNIQUE LOCAL HAMILTONIAN problem to be similar to the LOCAL HAMILTONIAN problem, 
where the conditions for a "no" instance are the same, but for a "yes" instance we demand that there exists a \^) 
with energy below the low-threshold, and all other eigenvalues are above the upper-threshold. We also define 
the UNIQUE 1-D 2-LOCAL HAMILTONIAN in a similar manner. 

It is not difficult to show (by observing that the construction used in MAGIK07II preserves the uniqueness) 
that; 

Lemma 4 unique 1-d 2-local hamiltonian is UQMA-Complete. 

■-, ^ 

Together with Theorem|2] which implies that QCMA C UQCMA C UQMA, we have 

Tlieorem 5 unique 1-d 2-local hamiltonian is QCMA-hard, under randomized reductions. 

From Theorem|5]we can deduce the following "no-go" corollary for the ground state of poly-gapped Hamil- 
tonians. Consider any set of states which are (i) described by po\y{n) parameters and (ii) from which one can 
efficiently compute expectation values of local observables. Matrix-Product-States are an example of such a set, 
and several others have recently been proposed ll APD"*" 06l I Vid07l IhKH"*" 08l . We can show: 

Tlieorem 6 Ground states of 1-D poly gapped local Hamiltonians cannot be approximated to inverse polyno- 
mial accuracy by states satisfying properties ( i) and ( ii), unless QCMA = NP. 



A state lip) € (C )®" has an MPS representation with bond dimension D if it can be written as 

d 



i^)= J2 tr(AW...A['3|n,...,i„>, (I) 

il, iji — l 



with a[^^ D X D matrices. Note that only ndD^ complex numbers are needed to specify the state. 
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The reason is that "yes" instances of the UNIQUE 1 -D 2-LOCAL HAMILTONIAN are poly-gapped, and there- 
fore such a description would place UNIQUE 1-D 2-LOCAL HAMILTONIAN in NP. 

To further analyze the complexity of the local Hamiltonian problem for poly-gapped Hamiltonians, we 
introduce a variant of the UQMA class, which we call poly-gapped QMA (PGQMA), as follows: in both 
"yes" and "no" instances we require there is a gap (given by a pre-determined quantity larger than an inverse 
polynomial in the input size) from the witness which accept with the largest probability to all the others. We 
show that the problem 1-D POLY-GAP LOCAL HAMILTONIAN, in which the Hamiltonians are promised to 
be poly-gapped, is complete for the class. We also present a simple randomized reduction from any UQMA 
problem to a PGQMA, which imphes 

Theorem 7 1-D poly-gap local hamiltonian is QCMA-hard, under randomized reductions. 

We thus see that, unless BQP = QCMAB the determination of the ground energy of poly-gapped 1-D local 
Hamiltonians is an intractable problem for quantum computation. Note that this conclusion cannot be drawn 
from the previous lower bounds on the complexity of the problem IIAGIK07I ISCV08I . Indeed, the results of 
IIAGIK07I concerning adiabatic quantum computation with a 1-D poly-gapped Hamiltonian indirectly imply 
that 1-D POLY-GAP LOCAL HAMILTONIAN is BQP-harcfl, while in IISCV08I the problem was shown to be hard 
for the class UP n Uco-NP (the intersection of unique NP with unique co-NP), whose relation with BQP is 
unknown. 

1.3 Impossibility Results for UQMA 

Finally, we examine the UQMA case. We show that attempting to apply the brute force analogue of the previous 
proofs in the case of UQMA, we already fail in the first (inefficient) component. A new idea seems to be 
required, if an extension of the Valiant- Vazirani approach is possible at all for QMA. 

To show this we construct a simple family of QMA "yes" instances which we believe captures the difficulty 
of the problem. 

Example 1 Let C be a quantum circuit on I qubits, with the property that there exists a subspace V of dimension 
2, s.t. V|?/') G V, Pr{C accepts |?/')) = 1, andy]^}) £ V-^, Pr{C accepts = 0. 

In the classical case, the analogous example of two solutions is easy to deal with by choosing a "filter" 
(hash-function) that screens about half of the witnesses. The natural quantum analogue to try, is to use a random 
projection that will reject half of the space. In proposition[T]we prove that such a transformation (even if it can 
be implemented efficiently) does not create an inverse polynomial gap between the two states in the subspace V: 
with probability exponentially close to 1, regardless of the dimensionality of the random projection, all states in 
V will be accepted with probabilities exponentially close to each other. 

The reason for this is that the projection of every iV-dimensional vector on a d-dimensional random sub- 
space is concentrated around with a standard deviation of order for a sufficiently large N . Therefore, 
regardless of how we choose d, we always get that the gap is less than which is exponentially small. Hence, 
the behavior of random sets - the filters in the classical setting - is very different from the behavior of random 
subspaces, the natural quantum analogue. 

One might hope that a more refined measurement would help. In fact IISen06ll has shown that the two 
distributions resulting from applying a random von Neumann measurement on two arbitrary orthogonal states 
have a constant total variation distance with all but exponentially small probability. This sounds promising; 
Moreover, a similar effect can be achieved efficiently by quantum i-designs as shown by IIAE07I . Unfortunately, 
a constant total variation distance between two distributions does not imply an efficient method to distinguish 

''BQP is the class of problems which can be efficiently solved, with high probability, by a quantum computer 

^The construction of tAGIK07 | for adiabatic quantum computation with one-dimensional Hamiltonians provides a way to encode the 
outcome of any polynomial quantum computation into the expectation value of a measurement, in the computational basis, of the first site of 
the ground state of a 1-D poly-gapped local hamiltonian, with a zero ground state energy. By adding a small perturbation to the Hamiltonian, 
penalizing the first site when it is not in the zero state, and with a strength much smaller than the spectral gap, but still inverse polynomial 
in the number of sites, we can readily conclude that this construction shows that 1-D POLY-GAP LOCAL HAMILTONIAN is BQP-hard 
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between them; this problem is tightly related to complete problems for the complexity class SZK, which are not 
known to have a quantum polynomial time algorithm. Thus, the problem of whether UQMA ^ QMA remains 
wide open. 

1.4 Organization of the paper 

The structure of the rest of the paper is as follows: in Section lzTl we present the definitions. Section [previews 
the proof of the Valiant- Vazirani Theorem, while Sections |4] and |5] contain the extension of the theorem to the 
classes MA and QCMA, respectively. In section |6] we discuss some alternate definitions of the class UQMA, 
and complete problems for this class. We also show that the two classes are equivalent, under randomized 
reductions. Finally, in section [T] we prove impossibility results regarding extending our results to QMA using 
similar ideas. 

2 Definitions 

We start by defining a few standard complexity classes which we will consider throughout the paper Then we 
turn to the definition of unique versions of MA, QCMA, and QMA, which to the best of our knowledge, have 
not been formalized before. 

2.1 Background Definitions 

Definition 8 (Nondeterministic Polynomial (NP)) A language L G NP if there exists a Turing Machine (TM) 
M which runs in polynomial time in its first argument s.t.: 

1. X e i => Ely s.t. AI{x, y) accepts. 

2. X ^ L ^ \/y M{x, y) rejects. 

Definition 9 (Unique Nondeterministic Polynomial (UP)) A prom/ie /?ro/7/em L = {Lyes,Lno) G UP if 

there exists a Turing Machine (TM) M which is polynomial in its first argument s.t.: 

7. X e Lyes =^ 3y s.t. M{x, y) accepts and^y' ^ y M(x, y') rejects. 
2. X E Lno ^ Vy M{x, y) rejects. 

Definition 10 (Merlin-Arthur (MA)) A promise problem L = {Ly^s, Lno) G MA if there exists a probabilistic 
polynomial TM M which is polynomial in its first argument, and its random bits are denoted by the string r, 
s.t.: 

1. X G Lyes 3y s.t. Prr{M{x,y,r) accepts) > 2/3. 

2. a; G Lno ^ Vy Prr{M{x, y, r) accepts) < 1/3. 

Definition 11 (Quantum Classical MerUn-Arthur (QCMA)) A promise problem L = (Lyes, Lno) G QCMA 

if there exists a polynomial quantum circuit Ux which can be computed in poly{\x\) time, having l{x) qubits as 
input and requiring m{x) ancilla qubits initialized to |0™), such that 

1. xe Lyes ^ 3y s.t. \\IliU4\y) ® |0"))|12 > 2/3. 

2. xe Lno ^ Vy \\UiU4\y) ® |0"))f < 1/3. 

Hi is the projection onto |1) in the first qubit, i.e. Hi := |1)(1| ® Ii+rn-i- We write I = l{x) and m = m{x) 
when x can be understood from the context 
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Definition 12 (Quantum Merlin-Artliur (QMA)) A promise problem L = {Lyes, Lno) G QMA if there exists 
a polynomial quantum circuit Ux which can be computed in poly{\x\) time, having l{x) qubits as input and 
requiring m[x) ancilla qubits initialized to jO™), s.t. 

1. xe Lyes => s.t. ||nit/,(|^) ® |0™})f > 2/3. 

2. xe L„o => ||ni[/,(|^) ® |o™))||2 < 1/3. 

Hi is the projection onto |1) in the first qubit. 

2.2 New Definitions 

We now describe the analogue unique versions for the classes MA and QCMA and QMA. 

Definition 13 (Unique Merlin-Artliur (UMA)) A promise problem L = {Lyes, Lno) e UMA if there exists a 
probabilistic TM M which is polynomial in its first argument s.t.: 

1. X e Lyes 3y s.t. Prr{M{x,y,r) accepts) > 2/'iand\/y' ^ y, Prr{M{x,y' ,r) < 1/3. 

2. X E Lno =^'^y Prr{M{x,y,r) accepts) < 1/3. 

Definition 14 (Unique Quantum Classical Merlin-Arthur (UQCMA)) A promise problem L = {Lyes, Lno) & 
UQCMA if there exists a polynomial quantum circuit Ux which can be computed in poly{\x\) time, having l{x) 
qubits as input and requiring m{x) ancilla qubits initialized to |0™), such that 

L xe Lyes => By s.t. \\IliUx{\y) ® |0'"))f > 2/iandyy' / y, Wn^U^Qy') ® |0™))||2 < 1/3 

2. X e Lno => Vy \\niUx{\y) ® |0™))||2 < 1/3. 

Hi is the projection onto |1) in the first qubit. 

Definition 15 (Unique Quantum Merlin-Arthur (UQM A)) A promise problem L ~ {Lyes, Lno) £ UQMA 

if there exists a polynomial quantum circuit Ux which can be computed in poly{\x\) time, having l{x) qubits as 
input and requiring m{x) ancilla qubits initialized to 10™), s.t. 

L xe Lyes ^ 3\i')\\IliUx{\^p) ® |0™))||2 > 2/3 andy\cj))±\4>), ||ni[/,(|0} ® |0™))f < 1/3 
2. xe Lno ^ V|V) \\UiUx{\ij) ® |0™))||2 < 1/3. 

3 The Valiant- Vazirani Proof Revisited 

In this section, we review the results of IIVV85I . We divide the proof into three components, so that we can 
better understand which components of the original construction fail in the probabilistic and quantum setting. 
The main result proved by Valiant and Vazirani can be stated as follows: 

Theorem 16 HVV85]! If UP C RP ^ NP C RP. 

The standard proof of the theorem works with the well known NP-complete problem SAT. We will not use 
it, as there is no simple variant of SAT which is complete for the classes MA and QCMA. 

Definition 17 (TRIVIAL NP Problem (TNPP)) The words in L are tuples, {V, x, I, t), where V is a descrip- 
tion of a deterministic Turing machine, x is a string of length n, and < G N, given in unary. 
{V, X, l,t) e L if there exists a y with \y\ = I s.t. 'V{x, y) accepts in t steps. 

It can easily be seen that TNPP is NP-Complete. The following promise problem is a "unique" version of TNPP. 

Definition 18 (UNIQUE-NP Promise Problem (UNPPP)) The promise problem is L = {Lyes, Lno). The 
words in L are tuples, {V, x, I, t), where V is a description of a deterministic Turing machine, x is a string of 
length n, and l,t e N, given in unary. 

(V, x, I, t) e Lyes if there exists exactly one string y s.t. \y\ = I and V{x, y) accepts in t steps. (V, x, I, t) e 
Lno if for all strings y s.t. \y \ = t, V{x, y) does not accept in t steps. 
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3.1 Proof Sketch 



We begin with an instance / and a language L e NP, and we should decide if / G L. The first step is to use 
the completeness of TNPP to find an instance / = (V, x, Z, t) with the property I ^ L <;=^ / G TNPP. 
There are three main components in the proof, which we shall, now, explain. 

Component 1: The right random "filter" for the right size 

Let W be the set of accepting witnesses: W := {y : \y \ ~ I and V{x, y) accepts in t steps}, and let \ W\ = w. 
Notice that / e TNPP w ^ 0. 

Definition 19 (R-restriction) Let R be a set of strings, each one of them of size I, with the property that there 
is an algorithm that answers whether y G R in exactly T time steps. Given a Turing machine V, we call the 
following Turing machines the R-restriction ofV, and denote it by Vr: 

1- Uy ^ R' Reject. Otherwise, Continue. 

2. Run V on (x, y). 

We see the i?-restriction as a filter added to the original problem, because the new machine accepts only 
accepting witnesses of the original machine, which belong to the set R. 

Let us denote by /' the instance (Vr, x, Z, t + T). Component 1 takes the filter i? to be a random set, where 
each string in {0, 1}' is chosen independently with probability w^^. Notice that the Turing machine Vr might 
not have a short description, because in order to decide whether y € R, all the elements of R should somehow be 
"hard-wired" to the machine. If \R\ is exponential in then by using Kolmogorov Theory arguments IICTWI06I . 
there is no short description for such a circuit, therefore the description of Vr will not be short. Therefore, the 
mapping between / to /' is not efficient. This drawback will be circumvent in component 3. 

We claim that /' will be in UNPPPyes with probabiUty 17(1). Let W = {y : \y\ = I and Vr{x, y) accepts in t+ 
T steps}. Defining W = [wi, ...,w\w\}, 

Pr{I' G UNPPPyes) = Pr{\W'\ = 1) 

= Pr{\Wr\R\ = l) 

w w 

> 1/e. (2) 

The first equaUty follows from /' G UNPPP w' = I and the second from W ^ W n R. The third 

is a direct consequence of the definition of Wi. The fourth stems from the facts that the events in the line above 
are all disjoint, and using the definition of the set R. Therefore, querying the oracle with {V , x,l,t + t') results 
in a "yes" with probability of at least ^. 

Using this idea, we create 2' instances, Ii, I21, one for every possible value of w: Ij = {Vj, x,l,t + t'). 
We claim: 

Lemma 20 (Completeness) If I £ TNPP, then there exists a j for which, with probability 17(1) over the 
choice ofR, Ij G UNPPPy,,. (Soundness) If I ^ TNPP, then all the Ij are in UNPPPno- 

Proof: Completeness: Follows from the previous argument: one of the Ij's is /t„ G UNPPPyes with 
probabihty of at least 1/e. Soundness: / ^ TNPP ^ W ^ d). As Wj = W Ci Rj, Wj = 0, and therefore 

Ij G UNPPPr^o. ■ 

Our algorithm consists of querying UNPPP with Ii, ...,l2i. If one of the results is yes, we accept. The 
completeness asserts that for a "yes" instance, we accept with constant probability. The soundness asserts that 
we always reject in "no" instances. 
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Component 2: Approximated "filter" also works 



The second component concerns the fact that we do not know the value w and, therefore, in order to use the 

algorithm given in component 1, we need exponentially many queries to the UNPPP oracle. The key to the 

solution is to realize that being wrong about the size of w by a constant factor, only changes the probability of 

having a unique solution by another constant factor 

More explicitly, we transform our instance / into a polynomial number of random instances: Ii, I2, Ii- 

These instances are formed by choosing random sets Rk again; but now, each element is taken with probability 
j_ 

2k ■ 

A similar statement to Lemmal20lalso holds here. To analyze the completeness of the protocol, we notice 
that for some k, 2^ <w < 2^^^ . Hence, for such k, 

Prih &UNPPPye,) = Pri\Wk\^l) 

= Pr{\WnRk\ = l) 

= Pr(^[j{y,eWn,^,y,(^W)^ 

Therefore, when asking the oracle I — 1 queries, at least one of the answers will be "yes", with probability of at 
least l/e^. The soundness analysis uses the same argument as in component 1. 



Component 3: Approximated pseudo random filter is just as good 

The third component deals with the inefficiency of randomness: a random and exponential large set R cannot 
be determined by a polynomial description. The solution is to replace the randomness by a suitable notion of 
pseudo-randomness. In this case, the pseudo-random objects of interest are pairwise independent universal hash 
functions aAB09l| . 

Definition 21 (pairwise independent hash functions) A family of functions ]HI„_,„ where each h e M, h : 
{0, 1}" ^ {0, 1, }™ is called a pairwise independent universal family of hash-functions if: 

1. ^ 

Vyi 7^ 2/2 e ^, Va, 5 e B, Prhr^uViiHyi) = a and h(y2) = 6) = 

2. There exists a Turing Machine PRINT-H s.t. for every n, m e N and j G !!„.,„, PRINT-H{n, m, j) 
prints a description of another Turing machine, which computes hj G ]H[„.m. By abuse of notation, we 
also denote the Turing machine which computes hj by hj. The printing is done in poly{n, m) time. 

3. The running time of each h G ]HI„,„i is bounded by some poly{n, m) time. 

Note that this probability is the same as if the map h was random, although h has a short description (unlike a 
random function which has no compact description). 

Instead of choosing Rk to be a random set, we pick a random universal hash function hk from the set ; 
The set Rk is h^^{{)) — {y\hk{y) — 0}. Evaluating hk{y) is polynomial in I, and therefore, step 1 of Vk takes 
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only polynomial time. To conclude, our algorithm is described in Alg. [T] 
Input: The tuple {V, x, I, t). 

Output: if a; G TNPP accept with some constant probability, \f x ^ TNPP reject (with probability 1) 

1 foreach k e [I] do 

2 Sample a hash-function uniformly at random hk ^i,k+2 and let Rk ~ h^^{0) 

3 Denote by Vk the i?fe-restriction of V. 

4 Query the UNPPP oracle with 4 = {Vk,x,l,t + and put the result in rfc. 

5 end 

6 if 3k s.t. Tk = 1 then 

7 I accept 

8 else 

9 I reject 
10 end 

Algorithm 1: TNPP solver, which uses polynomially many queries to UNPPP 

"We will denote by T^.t the running time of h(y) where h G Hu We need the reasonable assumption that the running time is the 
same for all h's and y's and that it is an easy to compute function. We changed the time f to be t + Tj j^_2, because the machine Vfe(x, y) 
needs to do one evaluation of the hash function, compared to the machine V. 

It hence suffices to prove lemmal20lin order to show UP C RP => NP C RP, because then Alg. [T]is in RP. 
First, we need to show that the algorithm takes polynomial time. The only suspect is step[T] The preparation of 
the description Vk takes polynomial time, as in the definition of hash function (definition[2TI). 

Soundness: In the case that / ^ TNPP, then by the soundness of lemmal20l all the r^'s in step[T]are false, 
and, therefore, in step[T]the condition does not hold, so we always reject. 

Completeness: By combining the assumption that UNPPP is in RP, and the completeness of lemma l20l 
we have that if / G TNPP, then with probability ft{l) over the choice of hk, Ik G UNPPPyes, and therefore 
for that k the query in step [T] will return "accept" with probability 2/3. Therefore, the overall probability of 
accepting is at leastjil(l) = ^^(1)- 

Proof of Lemma l20t Soundness: Same argument as before. 
Completeness: We make use of the following lemma: 

Lemma 22 Let W C {0, 1}" of size w, such that 2^ < w < 2'°+^, and let h be a random universal hash 
function from the set M.i^k+2, which is a set of functions from {0, 1}' to {0, 1}*^"'"^. Then, 

Pr(\h-^{Q)r\W\ = 1) > 1/8. 

We prove this lemma in Appendix lAl Note that Ik = (V/j, x, y,l,t + Ti^k+2) G UNPPPyes is equivalent 
to iVt^fel = 1. We have that Wk^Wr]Rk = Wn h^\0) and Lemma|22]tells us that \h'^\0) nW\^l with 
probability at least 1 /8 over the choice of h. 

The fact that the description of Vk is efficient makes sure that step[T|of Alg. [T]only takes polynomial time. 
All the other steps can be easily seen to take polynomial time as well. ■ 



4 Valiant- Vazirani Extended to the Class MA 

In this section we prove Theorem[T] which can also be formulated as: 
Theorem 23 UMA e RP =^ MA e RP. 

Definition 24 (Trivial MA Promise Problem (TMAPP)) TMAPP = {Lyes,Lno)- The words in tmapp are 
tuples, (V, x,pi,p2, 1, t), where V is a description of a probabilistic Turing machine, x is a string of length n, 
and < pi < P2 < 1> where P2 ^ Pi > 1 /poly{n), and l,t (zN, given in unary. 
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{V, x,pi,p2,l,t) e Lyes if there exists a string y s.t. \y\ = I and Pr{V{x,y) accepts in t steps) £ 
'^yes — interval". 

{V,x,pi,p2,l,t) e Lno if for all strings y of length I, Pr(V{x,y) accepts in t steps) G ^"no — interval". 

It can be easily seen that TMAPP is MA-Complete. 

We start with a language L G MA and an instance /' and we should decide whether /' G L or not. The first 
step, as was done in the NP case, is to use the completeness of TMAPP, and reduce it to the question whether 

/ = {V,X,pi,P2,l,t) G TMAPPyes Or / G TMAPP„o. 



1 1 



■P2 «ss3ss^ P2 



■ Pi Pi 



1 "^^'^'^ 



Figure 1 : Typical "no" and "yes" instances 
The y-axis is probability. The ellipses are all the 2' different witnesses of a specific instance. The red lines 
outUne the boundaries, [pi , P2] - the maximal acceptance probability of a MA instance are promised not to be in 
that interval. The left one is a "no" instance, the maximal probability of acceptance is less than pi. The right 
one is a "yes" instance, because the maximal probability of acceptance is greater than p2- 

Hence, our goal is to create a transformation which takes a TMAPPyes instance (right side of Fig. [T]) to a 
VMAPPyes instance (Fig. ^ with constant probability, and a TMAPP„o instance to a UMAPP„o instance (left side 
of Fig. [U with probability 1 . We divide the potential witnesses into 3 groups, by their probability of acceptance: 

Yno = {y\ \y\ = I and Pr{V{x, y) accepts in t steps) G "no — interval"} 
Ygap = {_y\ \y\ = I and Pr(V{x, y) accepts in t steps) G "gap — interval"} 
Yyes = {y\ \y\ = I and Pr{V{x, y) accepts in t steps) G "yes — interval"} (3) 

Let us look at the i?-restriction of V, Vr, where i? is a random set and each element in [2'] is taken with 
some probability p. We denote it by /' = (Vr, x,pi,p2, l,t + t'), where t' is the time taken for the machine 
Vr to make its first step. Define FJ^^ , Yg^^, Y^^ for /', as was done for / in Equation|3] For every y of length I, 
denote by f{y) ~ Pr{V{x, y) accepts in t steps), and f'{y) = Pr{V'{x, y) accepts int + t' steps). 

Observation 25 

'0 ify i R 



fiy) 



f{y) ify&R 



Therefore, Yy^s Yy^s H R and Y^'^p = Ygap n R. 

Using the same method as in the NP case clearly fails, as we explicitly show in the following section. 
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Figure 2: A "unique yes" instance 
There is exactly one witness which is accepted with probability greater than p2, and all others are accepted 

with probability smaller than pi. 

4.1 Problems with the first component 

We present an instance that shows the failure of implementing component 1 in the probabiUstic case. The 
example is a jP^obiemaUc ^ (yprobiematic ^ ^^^^^^^j^^'^ g TMAPPygs instance which can be seen in Fig|3] 
with the property that |yp™Wematic| ^ 2, |y-p™Wemat»c| = 2' - 2 and \YP^obiemaUc^ ^ q 

Because the size of the set Ygap is exponentially bigger than Yy^g, we cannot "filter" - by using the random 
set R - one element from Yyes and none from Ygap with non-negligible probability: Suppose we pick the size 
of R by the set Wq, so each element is chosen with probability 1/2. With probability ft{l) exactly one element 
will be chosen from Wq, but about half of the elements of Wi will also be chosen. Therefore, it fails to hold 
the second property of a UMAPPyes instance. If we pick elements in R by the size Wi, which means that each 
element is picked with probability then with probability (1 — 31^)^ (which is exponentially close to one), 
no element will be picked from Wq, therefore it fails to hold the first property of a UMAPPyes instance. 

4.2 the fourth component 

The missing property in the example of section|4T|is formalized in the next definition: 

Definition 26 ("lightweight-gap" instance) Aninstancel = {V,x,pi,p2,l,t) is a "lightweight-gap" TMAPPy 
instance if it is a TMAPP^es instance, and \ Ygap\ < 3|Kyes|- 

Lemma |30l explains how this kind of instances does not have the problem that was shown in section \4A] 
But first we will see how to create a very simple transformation which takes a general TMAPPj^es instance to a 
"lightweight-gap" TMAPPye^ instance: 

Lemma 27 Let I be a TMAPP instance. There exists an efficient transformation that maps I to several instances 
/i, I1-2 with the following properties: 

• If I G TMAPPyps then 3k s.t. Ik is a "lightweight-gap" TMAPPye^ instance. 

• Ifie TMAPPno then Mk Ik e TMAPP„o instance. 
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1 






Figure 3: A problematic ma-instance; it has numerous witnesses with probability inside the "gap-interval" and 
very few in the "yes-interval". 



Proof: The transformation is the following. We start by applying amphfication: We can reduce the instance 

/ = {V , x,pi,p2,l,t) to I = {V,x,j,l— j,l,t). This is done by using standard error reduction techniques. 

Observation 28 Let h ~ (y,x,pi,p2,l,t) and let h — {V, qi, q2,l,t), where [91,(72] C [pi,p2]- 

• /l e TMAPPj,es =i> ^2 e TMAPP^es- 

• /l e TMAPP„o ^ /a e TMAPP„o- 

The observation follows immediately from the definitions of TMAPP. 

The second step of the transformation is the following: we take the instance / = (y,x, j, 1 — 
and create / — 2 instance, /i, ...,/;_2, where Ij = {V,x, |, ^^,l,t). By observation l28l we know that if 

/ e TMAPP j^es Vfc Ik e TMAPPyes, and that / G TMAPP„o ^ V/c /fc £ TMAPP„o- 

But in the case of a "yes" instance, the lemma demands a "lightweight-gap" TMAPPye^ instance. This is 
achieved using the following observation: 

Observation 29 (Existence of lightweight range) We define I ranges: rj = 1 < j < Z — 1. We 

define 

^ {y\ \y\ = ^ '^^'^ Pr{V{x, y) accepts in t steps) £ r^} 
Ifl^ {V,x,\,l - \,l,t) e JMAPPyes, then there exists a j s.t. \Yj\ <3|yj+i|. 

Proof: First, notice that \ Yi\ > 1, due to the fact that / G TMAPPyp^. Now, assume that the inequality does 
not hold for every j, i.e. \Yj\ > 3|Yj+i|. Then, |Yi| > 3'^^ > 2'. The total number of the witnesses is 2'. 
Contradiction. ■ 

All we need to notice to prove lemmalZTlis that if |lj | < 3| Yj_i |, then is a "lightweight-gap" TMAPP^es 
instance. Observation|29]asserts that such a j indeed exists. ■ 

Until now we have shown how to transform the instance to a "hghtweight-gap". The following lemma 
proves that component 1 works for this kind of instances: 
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Figure 4; A yes-instance, with its lightweight range. 

Lemma 30 Suppose I = {V,x,pi,p2,l,t) isalightweight-gapTMAVPyesinstance. Define f = {Vii,x,pi,p2,l, 
t'), where Vr is the R-restriction ofV where each element in R is taken with probability p = ttt — tttv — r- Then, 

I ^ gap \ + \ J^yes \ 

with probability £^(1) (over the choice ofR), I' is a UMAPPyes instance. 
Proof: 

As was shown in component 1, with probability exactly one witness will be picked from the set 
Yyes U Ygap- The probability that the instance is from the set Yy^s is proportional to its size. Therefore Pr{I' E 

uMAPP.e.) = miY^fff^i > im- ■ 

Component 2 works without any change in the probabilistic setting: a constant approximation of the size 
\Yyes I is sufficient. In order to adapt component 3 to the present case, we need a simple variant of lemma [22l 

Lemma 31 Let S C {0, 1}' of size b, such that 2^ <b < 2^+^, Si C S of size a, and S2 ^ S \ Si. Let h be 
picked randomly from the set H„jt4_2. Then, 

Pr(|/.-i(0)n^il - 1 A |/i-i(0)n^2| = 0] > ^ 
The proof is given in Appendix |A] We apply lemma |3T| to our construction by setting = Yy^s , S2 = 

Ygap, S = Sif] S2. 
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4.3 Putting It All Together 

Assuming UMAPP e RP, then algorithm|2] which solves TMAPP, is also in RP. 





Input: / = (y, a;, 1 — J, J, Z, t), where V is a description of a probabilistic Turing 


machine, x is a string 








of length n, and < pi < p2 < 1, where P2 — Pi > 1 /poly{n), and t e T 


^, given in unary. 




Output: 


if a; G TMAPP^es accept with some constant probability, if x G TMAPP„o 


reject (with 










probability 1) 




1 


foreach fc e [Z 2] do 




2 




Define /fe - {V,x,!f,^,l,t). 




3 




foreach h G [I] do 




4 






Sample a hash-function in random h}, e HI„ f,+2. Denote by Rb = hj^ ^(0) 




5 






Create the i?b -restriction of V, Vt: 




6 






iihb{y) 7^ then 




7 








return "no" 




8 






else 




9 








result ^ Run (simulate) V{x, y) 




10 








return result 




11 






end 




12 






Define Ik,b = (H, a;, f , t + T,,6+2)lfl 




13 






Query the UMAPP oracle with Ik,b and put the result in j-^.f, . 




14 




end 






15 


end 








16 if 3k, b s.t. Tkfi = 1 then 




17 




accept 




18 


else 








19 




reject 




20 


end 









Algorithm 2: TMAPP solver, which uses polynomially many queries to UMAPP 



"We will denote by T^^b the running time of h(y) where h G Ha j,. We need the reasonable assumption that the running time is the 
same for all h's and j/'s and that it is an easy to compute function. We have changed the time t to be t + Ti i^2 because the machine 
Vif{x, y) needs to do one evaluation of the hash function, compared to the machine V , and therefore we need the additional time. 

That the algorithm takes polynomial time can be seen in the same manner as the NP case. For the soundness, 
we have that Vfc, 6 / G TMAPP„o I^.b S TMAPP„o, by using observation [28] and observation [25] Because 
a TMAPPjio instances is also a UMAPP„o instance, step |2| will always output 0, and therefore in step|2|we will 
always reject. Finally, let us analyze the completeness of the protocol. We know that / G TMAPP^e^. According 
to lemma [27] for some fc, Ik is a "lightweight-gap" TMAPP^es instance. Define Yy^s^^gap for in similar 
manner to Equation (|3]l. According to lemma [3T] with 5*1 = Yyes^ " ^Ap' S = Si S2, we have that 
Ik,b G UMAPPj^es, for a b such that 2'' <Yk < 2**+^ with probabiUty ^. 

5 Valiant- Vazirani Extended to the class QCMA 

The proof of Theorem|2]is identical to the MA case. 
Theorem|2]can also be formulated as: 

Theorem 32 UQCMA e RP=^ QCMA e RP. 

We define the QCMA analogue of tmapp and umapp to be: 

Definition 33 (TQCMAPP) TQCMAPP = {Lyes,Lno)- The words in TQCMAPP are tuples, {U,pi,p2) where U 
is a description of a quantum circuit, with input of size I, s.t.: 
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1. (C/,pi,p2) G Lyes if there exists a string y of length I, s.t. Pr{U accepts \y)) S "yes — intervar . 

2. {U,pi,p2) € Lno if for all strings y of length I Pr{U accepts \y)) G "no — intervaF . 

Definition 34 (UQCMAPP) UQCMAPP = {Lyes, Lno)- The words in UQCMAPP are tuples, {U,pi,p2) where U 
is a description of a quantum circuit, with input of size I, s.t.: 

L {U,pi,p2) € Lyes if there exists a string y of length I, s.t. Pr{U accepts \y)) G "yes — intervar and 
Vy' y Pr(U accepts |y)) € "no — intervaF. 

2. {U,pi,p2) S Lno if for all strings y of length I PriU accepts |y)) G "no — interval". 

All the steps realized previously can also be done here: We begin with a language L G QCMA and an 
instance /', and we need to decide whether /' G L or not. We use the completeness of TQCMAPP to reduce 
it to the question whether / = {U,pi,p2) G i or not. Notice that in order to use component 4, and apply 
lemma l27l we need to perform gap amplification, i.e. to transform {U,pi,p2) to {U, j, 1 — j}- This is not 
a problem, because standard amplification works also for QCMA: Given y we can create several copies of it 
without worrying about the "no cloning theorem", by measuring y in the standard basis, without disturbing \y). 

The TQCMAPP solver appears in Alg. [3] 



Input: / = {U, J, 1 — j), where f/ is a description of a Quantum Circuit, and < pi < p2 < 1, where 






P2-pi> l/poly{n) 


Output: if a: G TMAPPj^es accept with some constant probability, if x G TMAPP„o reject (with 








probability 1) 


1 foreach fc g — 2] do 


2 


Define /fe = ([/, ^ , ii+i). 


3 


foreach b e [I] do 


4 




Sample a hash-function in random hi, G IHI„,;,+2- Denote by Ri, = h^^ ^(0) 


S 




Create the i?b-restriction of U, Ub, which is implemented by a quantum circuit: 


6 




ifhbiy) 7^ then 


7 






return "no" 


8 




else 


9 






result ^ Run the circuit U on the state \y). 


10 






return result 


11 




end 


12 




Define = (C/fc,^,^,). 


13 




Query the UQCMAPP oracle with I/^ b and put the result in f, . 


14 


end 




15 end 






16 if 3k, b s.t. rk^b = 1 then 


17 


accept 


18 else 






19 


reject 


20 end 







Algorithm 3: TQCMAPP solver, which uses polynomially many queries to UQCMAPP 



Soundness and Completeness follow from the same arguments used in the MA case. This ends the proof of 
TheoremlH 

6 The Robustness of UQMA 

6.1 Discussion about QMA and the Marriott- Watrous Formalism 

In this section we discuss the robustness of our definition of unique QMA and prove Lemma|4] 
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From Definition [T2l we see that for a given QMA verification scheme and a state \'4>), its probability of 
acceptance is: 

Pr (verifier accepts \i>)) = \\IliU^{I 
A useful operator in this context, as defined in IIMW05L is the following 

g = (/r„® (o'"|)c/^niC/(/® |o")). (4) 

Note that 

Pr (verifier accepts jV'}) = (5) 

As Q is Hermitian, there is a basis of orthonormal eigenvectors {|V''i})?=i for which Q = Ai|?/'i)(?/'i |, where 
\{Q) > \+i{Q) are the eigenvalues of Q. Note that by knowing the eigenvectors and eigenvalues of Q we 
can find out the acceptance probability of every witness in a simple way 

(Vig^') -^<a,(V.|QIV',) (6) 

= ^a*ajXj{%l),\i^j) = ^ |a,;pA,;, 

where = 

Let us consider another possible definition of the class UQMA. 

Definition 35 (UQMA) A promise problem L = {Lyes, Lno) G UQMA if there exists a polynomial quantum 
circuit Ux which can be computed in poly{\x\) time, having l{x) qubits as input and requiring m{x) ancilla 
qubits initialized to jO™), s.t. 

1. X e Lyes Ai(Q) > 2/3 and X2{Q) < 1/3. 

2. xe Lno Ai(Q) < 1/3. 

Where Ai > A2 > . . . X2'{x) '^''^ the eigenvalues of Q. 

Lemma 36 (Equivalence of Definitions [Island l35t A language L= {Lyes, Lno) & UQMA according to Def- 
inition [T5\ <==^ L G UQMA according to Definition \35\ 

Proof: We start proving that given a / e Lyes according to Definition [Tsl it is also in Lyes according to 
Definition [35] We now from Definition [15] that there is state which is accepted with probability of at least 
2/3. According to Eq. ([Sjl, the acceptance probability of \ip) is {ip\Q\ijj) = p > 2/3. From Eq. ([6]l, in turn, we 
see that p can be written as a convex combination of the A's. Therefore, Ai > 2/3. 

We now prove that A2 < 1/3. Denote by V the subspace spanned by the eigenvectors with eigenvalue 
greater than 1/3. Note that y\4>) G V {<j)\Q\(j)) > 1/3. If dim{V) > 2, there must exist a |0) G F orthogonal 
to \tp) and, therefore, the acceptance probability of \(f>) is greater than 1/3, which is in contradiction to the 
properties of an Lyes instance according to definition [TSl 

The other directions is straightforward. ■ 

We now turn to the proof of Lemma[4| Let us start with the precise definition of the problem UNIQUE 1 -D 
2-LOCAL hamiltonian: 

Definition 37 unique 1 -D 2-LOCAL hamiltonian.- We are given a 2-local Hamiltonian on n d-dimensional 
sites H = ^'th r = poly{n) arranged in a line. Each Hj has a bounded operator norm \ \Hj \ \ < 

poly{n). We are also given two constants a and b with b — a > l/poly{n). In "yes" instances, the small- 
est eigenvalue of H is at most a and all the other eigenvalues are above b. In "no" instances, the smallest 
eigenvalue is larger than b. We should decide which one is the case. 
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We now prove Lemma|4] That the problem is in UQMA can be seen by the following verification procedure. 
We expect as a proof the unique ground state of H. Given a witness we use the phase estimation algorithm 
(see e.g. Ref. IIWZ06I ) to determine, within inverse polynomial accuracy 5 with exponentially high probability, 
its energy, i.e. !■(/;}. Case it is smaller than a + (5, we accept; otherwise we reject. It is clear that in "yes" 
instances, there is one witness which is accepted with probability exponentially close to one (the ground state 
of H), while any state orthogonal to it is accepted only with an exponentially small probability (which is the 
probability that the phase estimation does not give the correct answer). 

The hardness of the problem for UQMA is a simple application of the construction of IIAGIK07L which 
presents a reduction from any problem in QMA to 1-D 2-LOCAL HAMILTONIAN with d = 12. The details 
of the construction are not important here. We only note that the low-lying eigenvectors of the Hamiltonian 
considered are well approximated, within an inverse polynomial, to a class of states parametrized by all possible 
proofs - called history states - with the property that two orthogonal proofs give raise to two orthogonal history 
states. Moreover, the probability of acceptance of a given proof is imprinted in the energy of the associated 
history state - again up to inverse polynomial accuracy. It is then clear that a problem in UQMA will give raise 
to valid instance of UNIQUE 1-D 2-LOCAL HAMILTONIAN, since in "yes" instances of the problem (which is 
the only case we must analyze), the second eigenvalue of the Hamiltonian, which is well approximated by the 
energy of the history state associated to the witness which has the second highest probability of acceptance, will 
be separated from the ground state energy by a constant factor. 

6.2 Yet Another New Class and its Equivalence To UQMA 

One might define a similar class to QMA, with the additional promise of the gap of its acceptance probability. 

Definition 38 (Poly-Gapped QMA (PGQMA)) A promise problem L = {Lyes,Lno) e GQMA if there exists 
a polynomial 5(\x\), and a polynomial quantum circuit Ux which can be computed in poly{\x\) time, having 
l{x) qubits as input and requiring m{x) ancilla qubits initialized to |0™), s.t. 

7. X e Lyes ^ Ai(Q) > 2/3 and (Ai(Q) - AslQ)) > S{\x\). 

2. X e Lno ^ Ai < 1/3 and (Ai(Q) - AalQ)) > S{\x\). 

Where Ai > A2 > . . . A2i(^) are the eigenvalues of the operator Q, defined in Eq. 0. 

The above definition is motivated by the LOCAL HAMILTONIAN problem, with the additional promise that 
the spectral gap of the Hamiltonian is inverse polynomial. Its one dimensional version is defined as follows. 

Definition 39 1 -D poly-gap local hamiltonian.- We are given a 2-local Hamiltonian on n d-dimensional 
sites H = Y^'j^i Hj with r = poly{n) arranged in a line. Each Hj has a bounded operator norm \ \Hj \ \ < 
poly{n). We are also given three constants a, b and A with b — a, A > l/poly{n). We have the promise that 
the spectral gap of H is larger than A. In "yes" instances, the smallest eigenvalue of H is at most a. In "no" 
instances, the smallest eigenvalue is larger than b. We should decide which one is the case. 

As in the unique case, we can show 

Lemma 40 1-D poly-gap local hamiltonian^ PGQMA-Complete. 

The proof is completely analogous to the reasoning we provided for Lemma|4] In order to prove Theorem 
I2I we need the following result. 

Lemma 41 PGQMA = UQMA 

Proof: We first show that UQMA C PGQMA. This inclusion is not immediate because of the following 
reason: If / G Lno G UQMA, then we know that Xi{Q) < 1/3, but we do not know whether {Xi{Q) — 
A2(Q)) > S. 
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Figure 5: A quantum R-restriction. On the left: a general description of a QMA verification scheme. On the 
right: its i?-restriction, where lift is the projection on the subspace R. The state is accepted only if in both 
measurements the outcome was 1 . 



In order to resolve this issue, we use the amplification property of QMA, and change the "no"-probability 
to be 1/3 — (5 instead of 1/3: so we have Ai(Q) < 1/3 — (5. Then, by a simple construction which we shall 
explain in the sequel, we add a single state which is accepted with probability 1/3, having Ai(Q) = 1/3 and 
^2{Q) < 1/3 — 5, which provides the necessary gap. 

Adding the 1 /3-eigenvalue is done by changing the circuit: we append another qubit to the input qubits, and 
measure it in the beginning of the circuit. If its state is 0, then we proceed as before. If it is 1, we measure all 
other input qubits in the computational basis. If all of them are 1, we accept with probability 1/3. Otherwise 
we reject. A simple calculation shows that the action of such a procedure is exactly as we want: it adds one 
1/3-eigenvalue, and 2' — 1 0-eigenvalues, which do not concern us. 

R 

We now show that PGQMA C UQMA. This is again not immediate, as case / e Ly^s G PGQMA, we 
know that \i{Q) > 2/3, but we do not know whether \2{Q) is below the "no"-probability. For this we use the 
fact that UQMAi/3 2/3 = UQMAa.h, where {h — a) > 1/poly. We know that for a / G Lyes there exists a for 
whichAi((3) > 2/3+ (j + l)f and X2iQ) < 2/3 + j|. So, we give the circuit as a UQMA2/3_|_j|2/3+(_,+i)| 
problem, for j ~ 1, . . . and for at least one j, it will be in Lyes- Thus by picking j at random, we get the 
required property. It is also easy to see that we have soundness in the above construction. ■ 



7 The QMA Case 

7.1 Random Projections Fail to Create Inverse Polynomial Gap 

As mentioned earlier, we have divided the proof of the Valiant- Vazirani Theorem into 3 components. Compo- 
nent 1 solves the problem in the simple case where the number of the accepting witnesses is known; Component 
2 improves it by observing that the size of the set can be only approximated, without a considerable effect on 
the probability of acceptance; Finally, Component 3 shows that we may achieve the same results by using a 
two-universal hash function instead of a random function, rendering the reduction efficient. 

In this section we show that even in the case where the number of solutions is known, as in component 1, we 
cannot - at least in the most direct approach - create a transformation that maps it to a "unique instance". The 
main difficulty in the QMA case is that we do not know in which basis to operate. Notice that if there exists a 
description (which Merlin can supply) of how to efficiently transform a standard basis state to one of the states 
that is accepted with probability greater than 2/3, then the problem is in QCMA. 

Let us define a possible quantum analogue of a i?-restriction. A natural generalization is - instead of re- 
stricting to witnesses which belong to some set R - to project onto some subspace R; We call this procedure 
a quantum i?-restriction. As we did in the discussion of component 1, we will not consider the efficiency of 
implementing the restriction. A diagram of a general circuit and its i?-restriction is given in Figure ITTT] 

While the relevant operator for the orig inal verification is Q = (// (g) (0'"|)C/tniC/(J; (g) 10™)), after the the 
i?-restriction it is given by Qj^ = (/,„ (g) {Q"^\)WlliIlfiIliA{Im ® lO*"')), where 11^ is a projection onto the 
subspace R. The quantum analogue of component 1 consists of taking the subspace i? to be a random subspace 
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of dimension d, chosen accordingly to the Haar measure, for some convenient d. The next proposition shows 
that this approach, unfortunately, fails. 

Proposition 1 For every e > 0, with probability larger than 1 — e, applying the quantum random R-restriction, 
with arbitrary d, to example\J}creates an instance with a gap smaller than g-i2^'/^+^. 

Proof: As the verification circuit already rejects any state in the orthogonal complement of the two-dimensional 
subspace V, it is clear that we only have to analyze the gap created on states in V. 

A rank d random projector can be written as UPdU\ where is a unitary drawn from the Haar measure 
and Pd := Y^Ui mv{U,d) := max|^)ev(?MC/Pdf/t jV^} - {^j^\UPdW\^j^), where IV^^) is the 

- up to a phase - unique orthogonal vector to in V. We consider the following quantity, which gives the 
expectation value of the gap created by applying the random i?-projection defined by UPdU^: 



^u~m.rimv{U,d)) ^ dUmv{U,d), (7) 

J(7(2') 

where the integral is taken over the Haar measure of the unitary group C/(2'). 

Let {|0}, |1)} be a basis for V . Note that mv{U, d) is given by the difference of the maximum Amax and 
minimum Amin eigenvalues of the following matrix 

_ / {o\uPdW\o) {0\uPdW\i) \ 

vu,k - y (i|[/p^[/t|o) {l\UPdW\l) J 
By Gersgorin disc Theorem ( IIBB97I p. 244), we find 

\XraUVu,k) - Xn.iniVu,k)\ < | (0 1 (JPrff/^ 1 0) - (1 1 t/P^C/^ 1 1) | + 2 1 (0 1 t/Pd(7^ 1 1) I , 

from which follows that 



dUmv{U,d)< dU\{Q\UPdU^\Q) - {l\UPdU^l)\+2 I dU\{Q\UPdU^\l)\ 

U(2') Ju(2') Jui2') 

Applying Lemmal42lto each of the two terms in the R.H.S. of the equation above. 



dUmviU.d) < J , , . + , ^ <2-'/2+2 

iu(2') ' V(2' + l)2'(2'-l) Y (2' + l)2'(2'-l) - 

for any 1 < fc < 2'. To complete the proof, note that by Markov's inequality, 

dU < 2~^/^+^/X, 



'U:mv{U,d)>X 

for every A > 0. Setting A = 2^'/^+^/e, we find that with probability 



dU = 1- dU>l-e, 

U:mv(U,d)<\ Ju:mv(U,d)>\ 



my 



([/, d) is smaller than 2-'/2+2/e. 



Lemma 42 For any traceless operator X G B{C^) 



where Pu X^Li |j>0'l- 
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Proof: From the convexity of the square function, 



\ 2 

/ dU\ti{UPkU^X)\] < [ dU\ti{UPkU^X)\\ 
lu{N) I Ju{N) 



To compute the R.H.S. of the equation above, we first note that 

/ dU\tx{UPkU^X)\^ = f dUtx[U®'^Pf^{U^)®^X®X^) 

JU(N) Ju(N) 



tr(( / dUU®^Pf^{U^)®^ \ X ® X^). (9) 
\Ju{N) ) 



By Schur's Lemma IIFH91I . 

/ dUU^^PtW^r^ = tr(Pr(I-SWAP))i-|^ 

tr(Pf2(]i + sWAP)) ^ + 



= -fc-^(I-SWAP) + 4^±^(I + SWAP), 

N{N -\y ' N{N + \y 

where SWAP if the swap operator and we used that tr(SWAP(Pfc ® Pk)) = tr(P|) = tr(Ffc) = k. Then, from 
Eq. dUl, 

/ dmr(C/P.t/tX)^=tr(XtX)f4^-4^ 
Ju(D) ^ ^ ^ ^ '\N{N+l) N{N-l) 

from which the lemma easily follows. ■ 



7.2 Using a Many- Outcome Measurement 



In the previous section we tried to solve example[T]by applying the most natural idea that comes to mind: do 
a random 2-outcome measurement, and see if one state can "pass" the projection with an amount which is not 
negligible, compared to the other state on the subspace. We found out that such a procedure fails. In this section, 
we analyze the use a many-outcome measurement. We begin by applying a measurement in a random basis (or, 
to put it differently, by applying a random unitary according to the Haar measure, and then measuring in the 
standard basis). This, of course, cannot be done efficiently, but we will deal with it later. 
Radhakrishnan et al. IIRRS05I have shown. 

Theorem 43 IIRRS05\I Let \'4>i)^ |'02) be two orthogonal quantum states in . Then, 



where M is a orthogonal basis chosen uniformly from the Haar measure. 



A stronger result was presented in Theorem 1 of IISen06l , which implies the same kind of result, but instead of 
the expectation, it asserts that the same holds with all but an exponentially small probability. 
Furthermore, Ambainis and Emerson IIAE07I have shown that: 



Theorem 44 Let IV'2} be two orthogonal quantum states in C . Then 



M(|Vi))-M(|V2)) =n{l 



where M is a POVM with respect to an e-approximate (4, 4)-design. 
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For our purpose, there is no need to understand what is an e-approximate (4, 4)-design, but only that there 
exists an efficient construction which enables us to realize the POVM M for any constant e. Notice that this 
is a constant POVM, and for every 2 states, the TVD of the distributions is constant. For more details of how 
one can implement a 4-design, see Theorem 1 of IIAE07I . Although the POVM is constant, it achieves the same 
result as a random object (many-outcome measurements) but in an efficient way, and therefore we see it as a 
"pseudo-random" object. 

So, how can we take advantage of that? Suppose we had the description of the distribution of Af(|i/;i)) and 
M(|V'2))- Then we could select a unique witness by accepting only when we measure an outcome j associated 
to the j's for which M(|-0i})(j) > M{\%l]2)){i)- In this wav we would get bv Theoreml44lthat is accepted 
with a 51(1) probability larger than \4'2)- Of course this approach does not lead to the solution of the problem, 
as the promise of having a description of the distributions is too strong. 

Indeed, although there is a classical description which would let us distinguish, with high probability, be- 
tween the two cases, there is no known general way to achieve that which is in BQP. We would like to note 
that there is a resemblance between this problem and the SZK-Complete given in Ref. |iVad99] , where in both 
problems, it is required to distinguish between two probabilities with some total variation distance. 
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A Proofs 

Proof of Lemma l22l Let {j/i, y2, Uw} be the elements of W. 

Pr{\h~^{Q)[\W\ = 1) = 

W 

Pr(U(/i(2/0 = 0f|/i(%)/0)) (10) 

w 

= ^Pr(/i(2/,)=0f|%,)^0) (11) 

w 

= Y.Pr{h{yi) = Q)Pr{{~\h{y,) ^ 0\h{y,) = 0) 

w 

= Pr{h{y,) = 0)(1 - Pr(|J h{y^) = ()\h{y,) - 0) 

w 

> Pr{h{yi) = 0)(1 - Y MKVi) = ^Hud = 0) (12) 
i=i j^i 

Equation ( fTOl i follows from the fact that all the elements in the union of equation (fTOl i are disjoint. Equation 
( fT2] i follows from the union bound. 

Because h is taken from a universal hash function set, we have that Pr{h{y,) = 0) = 1/2*^+2, Pr{h{y.j) = 
0\h{y,) = 0) = l/2'''+2. It was also given that u;/2'=+2 > 1/4 and w/2'''+2 < 1/2. So, 

= W2'+2(l-^)>l/8 (13) 
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Proof of Lemma l3ll 

The proof is almost the same; Let yi, ya be the elements of 5*1, and Ua+i, Vb the elements of 52- So, 

Pr{\h-\0)f]Si\ = 1 A |/i-i(0)f|52| = 0) 

a 

= Pr(|J(%,) = fl h{y,)^Q)). 

i=l l<3<b,j^i 

The next steps are exactly the same, until we get to: 

a 

> ^ Pr{h{y,) = 0)(1 - P^HVj) - 0\h{y,) = 0)) 

> a/2''+\l - {b-l)/2''+^) > 1/8^ 
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